RHSA-2021:0637 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 3.11.394 is now available with
updates to packages and images that fix several bugs and add enhancements.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

Security Fix(es):

• jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks (CVE-2020-2304)
• jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks (CVE-2020-2305)
• ant: Insecure temporary file vulnerability (CVE-2020-1945)
• jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information disclosure (CVE-2020-2306)
• jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes plug-in (CVE-2020-2307)
• jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates (CVE-2020-2308)
• jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes plug-in allows enumerating credentials IDs (CVE-2020-2309)
• ant: Insecure temporary file (CVE-2020-11979)
• python-rsa: Bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 3.11.394. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2021:0638

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update fixes the following bugs among others:

• Previously, the restart-cluster playbook did not evaluate the defined cluster size for ops clusters. This was causing come clusters to never complete their restart. This bug fix passes the logging ops cluster size, allowing restarts of ops clusters to complete successfully. (BZ#1879407)
• Previously, the `openshift_named_certificates` role checked the contents of the `ca-bundle.crt` file during cluster installation. This caused the check to fail during initial installation because the `ca-bundle.crt` file is not yet created in that scenario. This bug fix allows the cluster to skip checking the `ca-bundle.crt` file if it does not exist, resulting in initial installations succeeding. (BZ#1920567)
• Previously, if the `openshift_release` attribute was not set in the Ansible inventory file, the nodes of the cluster would fail during an upgrade. This was caused by the `cluster_facts.yml` file being gathered before the `openshift_release` attribute was defined by the upgrade playbook. Now the `cluster_facts.yml` file is gathered after the `openshift_version` role runs and the `openshift_release` attribute is set, allowing for successful node upgrades. (BZ#1921353)

All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

Solution

Before applying this update, ensure all previously released errata relevant
to your system is applied.

See the following documentation, which will be updated shortly for release
3.11.394, for important instructions on how to upgrade your cluster and fully
apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258.

Affected Products

• Red Hat OpenShift Container Platform 3.11 x86_64
• Red Hat OpenShift Container Platform for Power 3.11 ppc64le

Fixes

• BZ - 1837444 - CVE-2020-1945 ant: insecure temporary file vulnerability
• BZ - 1849003 - fact dicts returned are of type string rather than dict
• BZ - 1873346 - In-place upgrade of OCP 3.11 does not upgrade Kuryr components
• BZ - 1879407 - The restart-cluster playbook doesn't take into account that openshift_logging_es_ops_cluster_size could be different from openshift_logging_es_cluster_size
• BZ - 1889972 - CVE-2020-25658 python-rsa: bleichenbacher timing oracle attack against RSA decryption
• BZ - 1895939 - CVE-2020-2304 jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks
• BZ - 1895940 - CVE-2020-2305 jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks
• BZ - 1895941 - CVE-2020-2306 jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information disclosure
• BZ - 1895945 - CVE-2020-2307 jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes Plugin
• BZ - 1895946 - CVE-2020-2308 jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates
• BZ - 1895947 - CVE-2020-2309 jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows enumerating credentials IDs
• BZ - 1903699 - Prometheus consumes all available memory
• BZ - 1903702 - CVE-2020-11979 ant: insecure temporary file
• BZ - 1918392 - Unable to access kibana URLafter enabling HTTP2 on Haproxy router
• BZ - 1920567 - [release-3.11] - ca-bundle.crt(/etc/origin/master/ca-bundle.crt) is missing on the fresh installation process
• BZ - 1921353 - OCP 3.11.374 Upgrade fails with Either OpenShift needs to be installed or openshift_release needs to be specified
• BZ - 1924614 - Provide jenkins agent image for maven36
• BZ - 1924811 - Provide jenkins agent image for maven36
• BZ - 1929170 - kuryr-cni pods in crashloop after updating OCP due to RuntimeError caused by attempting to delete eth0 host interface
• BZ - 1929216 - KeyError: 'addresses' in kuryr-controller when Endpoints' slice only lists notReadyAddresses

CVEs

• CVE-2020-1945
• CVE-2020-2304
• CVE-2020-2305
• CVE-2020-2306
• CVE-2020-2307
• CVE-2020-2308
• CVE-2020-2309
• CVE-2020-11979
• CVE-2020-25658
• CVE-2021-21602
• CVE-2021-21603
• CVE-2021-21604
• CVE-2021-21605
• CVE-2021-21606
• CVE-2021-21607
• CVE-2021-21608
• CVE-2021-21609
• CVE-2021-21610
• CVE-2021-21611

References

• https://access.redhat.com/security/updates/classification/#important